OpenSSL v3.0.x Buffer Overrun Vulnerability

02 Nov / 2022

Cyber Security

CVE-2022-3602 – OpenSSL v3.0.x Buffer Overrun Vulnerability


CVE: CVE-2022-3602 and CVE-2022-3786
What Is Vulnerable?: OpenSSL versions 3.0.0 or later. It is worth noting that SSL v3.0.0 was released in September 2021.

What’s Happening?

October 26th, the OpenSSL project team announced a critical vulnerability that was found in their widely used TLS and SSL software library. An additional statement from the OpenSSL team on the 1st of November downgraded the vulnerability from critical to high, citing that testing feedback provided by security firms. Estimates from shodan.io, indicate that 16,000 of all websites using OpenSSL are currently using version 3.0.x or later. Currently, there is no known exploitation of these vulnerabilities in the wild. OpenSSL prior to v3.0.x are not vulnerable as the exploit is due to a decoding functionality which was introduced in v3.0.x.

Key Facts

  • This vulnerability can be a client/browser-based exploit via browsing to an attacker-controlled server presenting with a malicious certificate.
  • Alternatively, if an SSL server requests a certificate from the client, the client can provide a malicious certificate.
  • Could cause a local crash, remote code execution or unexpected behaviour.
  • Browsers are unlikely to be using OpenSSL v.3.0.x due to slow adoption.
  • OpenSSL v3.0.x is installed by default in some new versions of Linux distributions.

What You Can Do

  • Cythera is monitoring EndpointProtect and Managed Detection and Response clients for associated indicators of attack and post exploitation activities.
  • Cythera Vulnerability Management clients are actively being scanned for any instances of vulnerable versions of OpenSSL.
  • Consult with vendors to ensure that their software has been patched.
  • Any instances of OpenSSL v3.0.x should be patched to v3.0.7 which has been released as of the 1st of November. The patch can be found here.

Resources

You may be interested in

InfoStealer Threat: Weaponised CAPTCHAs

What is happening?Since the start of 2025, Cythera has observed a sharp increase in the volume of InfoStealer malware campaigns, deployed via cl…

Read More arrow_forward

Cythera’s Board Advisory Service: Briefing your board on cybersecurity obligations in under 2 hours

In the face of rising cyber threats, the role of board members in safeguarding an organisation's digital assets and information has never been m…

Read More arrow_forward

CRITICAL CITRIX ADC AND GATEWAY REMOTE CODE EXECUTION VULNERABILITY

CRITICAL CITRIX ADC AND GATEWAY REMOTE CODE EXECUTION VULNERABILITY CVE: CVE-2022-27518 WHAT IS VULNERABLE?Citrix ADC and Citrix Gateway 13.0 …

Read More arrow_forward